HopSkipJumpAttack: A Query-Efficient Decision-Based Attack

Abstract

The goal of a decision-based adversarial attack on a trained model is to generate adversarial examples based solely on observing output labels returned by the targeted model. We develop HopSkipJumpAttack, a family of algorithms based on a novel estimate of the gradient direction using binary information at the decision boundary. The proposed family includes both untargeted and targeted attacks optimized for ${\ell }_2$ and ${\ell }_{\infty }$ similarity metrics respectively. Theoretical analysis is provided for the proposed algorithms and the gradient direction estimate. Experiments show HopSkipJumpAttack requires significantly fewer model queries than Boundary Attack. It also achieves competitive performance in attacking several widely-used defense mechanisms. (HopSkipJumpAttack was named Boundary Attack++ in a previous version of the preprint.)

References in corpus (13)

• Scikit-learn: Machine Learning in Python
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Adversarial Machine Learning at Scale
• Distributional Smoothing with Virtual Adversarial Training
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Black-box Adversarial Attacks with Limited Queries and Information
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Zeroth-Order Stochastic Variance Reduction for Nonconvex Optimization

Cited by in corpus (28)

• Label-Only Membership Inference Attacks
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• Black-box Adversarial Attacks with Bayesian Optimization
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• Detecting Adversarial Examples and Other Misclassifications in Neural Networks by Introspection
• Input Validation for Neural Networks via Runtime Local Robustness Verification
• Decision-based Universal Adversarial Attack
• GeoDA: a geometric framework for black-box adversarial attacks
• RayS: A Ray Searching Method for Hard-label Adversarial Attack
• Enhancing Adversarial Defense by k-Winners-Take-All
• RoVISQ: Reduction of Video Service Quality via Adversarial Attacks on Deep Learning-based Video Compression
• QEBA: Query-Efficient Boundary-Based Blackbox Attack
• Projection & Probability-Driven Black-Box Attack
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• Adversarial Attacks on Classifiers for Eye-based User Modelling
• Robust binary classification with the 01 loss
• On ${\ell }_p$-norm Robustness of Ensemble Stumps and Trees
• On the transferability of adversarial examples between convex and 01 loss models
• Adversarial robustness via stochastic regularization of neural activation sensitivity
• Who's Afraid of Adversarial Transferability?
• Orthogonal Deep Models As Defense Against Black-Box Attacks
• Derivation of Information-Theoretically Optimal Adversarial Attacks with Applications to Robust Machine Learning
• Target Training Does Adversarial Training Without Adversarial Samples
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
• Towards adversarial robustness with 01 loss neural networks
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks
• One Man's Trash is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples
• Tricking Adversarial Attacks To Fail